SIGSEGV/UB from safe code, Usize overflow allowing out of bounds wright
- Dominant language
- Rust
- Stars
- 4.8k
- Forks
- 565
- PR merge metrics
- No merged PRs in 30d
Description
Hi,
I am the Co-Lead of the Cargo Team and was recently hired by the Rust Foundation to help triage AI discovered bugs. This bug was found with AI, namely [scrutineer](https://github.com/alpha-omega-security/scrutineer) and gpt-5.6-sol. Except where specifically labeled this report was written by me.
This test panickes with `attempt to multiply with overflow` in debug, and `SIGSEGV: invalid memory reference` in release.
```rust
#[test]
fn wrapped_dimensions_allow_safe_out_of_bounds_write() {
let dimension = 1usize << 32;
let mut matrix = DMatrix::::from_vec(dimension, dimension, Vec::new());
matrix[(0, 0)] = 1;
}
```
This example can also be constructed with `serde_json::from_str`, `MatrixViewMut::from_slice_with_strides_generic`, `view_with_steps_mut`, `reshape_generic` in addition to `from_vec`. Because they all use the same check in `assert_view_index`. Which does not correctly check for overflow. Allowing safe code to synthesize an invalid pointer.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by running the `wrapped_dimensions_allow_safe_out_of_bounds_write` test and tracing `assert_view_index`. Compare the named construction paths: `from_vec`, `MatrixViewMut::from_slice_with_strides_generic`, `view_with_steps_mut`, `reshape_generic`, and `serde_json::from_str`. Done means the reproducer no longer permits an invalid access or release-mode memory fault.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100